Repository navigation
Remove feegrant module - #3958
Merged
Merged
Conversation
Remove the feegrant module and its keeper, store, CLI, APIs, protobuf definitions, simulation support, and application wiring. * Delete the feegrant store during the v6.7 upgrade. * Reject transactions specifying a distinct fee granter. * Retain the transaction granter field for wire compatibility. * Retire precompile 0x1010 with a deterministic revert. * Remove feegrant from SeiDB, wasmd, tooling, and Swagger. * Preserve historical genesis files unchanged. * Regenerate embedded API documentation and update tests.
|
The latest Buf updates on your PR. Results from workflow Buf / buf (pull_request).
|
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## main #3958 +/- ##
==========================================
- Coverage 58.68% 57.50% -1.18%
==========================================
Files 2324 2222 -102
Lines 198833 186700 -12133
==========================================
- Hits 116681 107366 -9315
+ Misses 71396 69517 -1879
+ Partials 10756 9817 -939
Flags with carried forward coverage won't be shown. Click here to find out more.
🚀 New features to boost your workflow:
|
# Conflicts: # precompiles/feegrant/versions
masih
marked this pull request as ready for review
August 20, 2026 15:59
PR SummaryHigh Risk Overview The Reviewed by Cursor Bugbot for commit 9fbb389. Bugbot is set up for automated code reviews on this repo. Configure here. |
![seidroid[bot]](https://avatars.githubusercontent.com/in/2745135?s=60&v=4){kind=small}
There was a problem hiding this comment.
Clean, thorough removal of the feegrant module: the fee-granter rejection is correctly placed at a single choke point (Tx.ValidateBasic, reached by both CosmosStatelessChecks and ValidateBasicDecorator), the v6.7 module-version delete is needed because SetModuleVersionMap is additive, and no dangling references remain. No blockers; a few non-blocking notes on flatkv store deletion, ante-level test coverage, historical tx decodability, and the 0x1010 "deterministic revert" claim.
Findings: 0 blocking | 5 non-blocking | 2 posted inline
Blockers
- None at the file/PR level.
Non-blocking
- [suggestion] The new granter rejection is only exercised at the
tx.ValidateBasic()level (TestRejectsDistinctFeeGranter). Both fee-deduction sites that previously rejected a distinct granter —DeductFeeDecorator.checkDeductFeeandapp/ante.chargeFees— now silently deduct from the fee payer when a granter is set, so their safety rests entirely on ValidateBasic running first. An end-to-end case throughCosmosCheckTxAnte/CosmosDeliverTxAnte(and note thatapp/ante.goordersDeductFeeDecoratorbeforeNewValidateBasicDecorator) would pin the actual rejection rather than the helper. - [suggestion] Dropping
feegrantmodule.AppModuleBasic{}fromModuleBasicsunregisterscosmos.feegrant.v1beta1from the interface registry, so historical transactions containingMsgGrantAllowance/MsgRevokeAllowance(feegrant was live on pacific-1) become undecodable byseid q tx, the/cosmos/tx/v1beta1/txsservice, and anything else that decodes archived txs. Worth calling out explicitly in the CHANGELOG upgrade guide alongside the CLI/API removals. - [suggestion] Removing
--fee-accountfromAddTxFlagsToCmd(sei-cosmos/client/flags/flags.go) makes any existing script that passes it fail withunknown flagrather than a deprecation message. The CHANGELOG covers "CLI ... removal" generically; naming the flag would save operators a bisect. - 2 suggestion(s)/nit(s) flagged inline on specific lines.
|
|
||
| if upgradeInfo.Name == "v6.7" && !app.UpgradeKeeper.IsSkipHeight(upgradeInfo.Height) { | ||
| storeUpgrades := storetypes.StoreUpgrades{ | ||
| Deleted: []string{feegrantModuleName}, |
There was a problem hiding this comment.
[suggestion] CompositeCommitStore.ApplyUpgrades (sei-db/state_db/sc/composite/store.go:751) forwards only to memIAVL — its doc comment states "Data in flatKV is not affected by this method" — and returns early when cs.memIAVL == nil. Under the memIAVL-backed modes this deletion works as intended, but for write modes where non-EVM stores have moved to flatkv (MigrateAllButBank, AllMigratedButBank, FlatKVOnly), the feegrant keys survive the upgrade and keep contributing to the flatkv lattice hash.
This is the first store deletion since flatkv landed (the dex/accesscontrol precedents predate it), so it's worth confirming which write modes will be live at the v6.7 height, and whether orphaned feegrant data in flatkv is acceptable or needs an explicit cleanup.
| func TestFeegrantPrecompileIsNotRegistered(t *testing.T) { | ||
| const feegrantAddress = "0x0000000000000000000000000000000000001010" | ||
|
|
||
| _, exists := precompiles.GetCustomPrecompiles("v6.7", &utils.EmptyKeepers{})[common.HexToAddress(feegrantAddress)] |
There was a problem hiding this comment.
[suggestion] The PR description says "Retire precompile 0x1010 with a deterministic revert," but nothing implements a revert — 0x1010 simply becomes an unassigned address, so an EVM CALL to it succeeds with empty returndata, and this test only asserts absence from the map rather than call behavior.
Unlike Codex's read of this, I don't think it's blocking: feegrant.GetVersioned registered the precompile only under latestUpgrade, and v6.7 has not activated on any network, so there is no released height at which 0x1010 behaved differently. Either add a tombstone precompile that always reverts and assert the call result, or drop the "deterministic revert" claim from the description so the merge commit matches the code.
alexander-sei
approved these changes
Aug 20, 2026
Contributor
|
Running xreview locally |
sei-will
approved these changes
Aug 20, 2026
yzang2019
approved these changes
Aug 20, 2026
bdchatham
approved these changes
Aug 20, 2026
philipsu522
reviewed
Aug 20, 2026
codchen
approved these changes
Aug 21, 2026
# Conflicts: # app/ante.go # app/ante/cosmos_checktx.go # app/antedecorators/priority_test.go # app/app.go # app/legacyabci/check_tx.go # app/legacyabci/deliver_tx.go
sei-will
approved these changes
Aug 21, 2026
revofusion
pushed a commit
to revofusion/sei-chain
that referenced
this pull request
Oct 13, 2026
## Describe your changes and provide context Phase 3 of the precompile test refactor ([PLT-372](https://linear.app/seilabs/issue/PLT-372/refactor-precompile-tests)), building on the phase 1 framework (sei-protocol#3777) and the phase 2 coverage (sei-protocol#3786). Phase 2 covered the wasm-free precompiles **as they existed then**. Since that merged, `Generate v6.7 precompiles` (sei-protocol#3961), the scoped module authorizations (sei-protocol#3893, sei-protocol#3846) and the module Msg rpc surface (sei-protocol#3825) landed. This phase brings the suite back in line with the deployed interface. ### New specs | Precompile | Spec | Coverage | |---|---|---| | auth (0x…100D) | `auth.spec.ts` | `account` / `accounts` / `params` / `nextAccountNumber`, LCD parity incl. the nested base account module accounts wrap theirs in | | authz (0x…100E) | `authz.spec.ts` | `grants` / `granterGrants` / `granteeGrants`; the non-empty fixture is a `staking.grantStakingAuthorization`, since authz itself cannot grant | | evidence (0x…100F) | `evidence.spec.ts` | `evidence` / `allEvidence` against the module's own list | | mint (0x…1012) | `mint.spec.ts` | `params` / `minter` vs Sei's own `/seichain/mint/v1beta1/...` routes | | params (0x…1013) | `params.spec.ts` | `params(subspace, key)` vs the staking module, plus the unknown/empty subspace reverts | | slashing (0x…1014) | `slashing.spec.ts` | `params` / `signingInfo` / `signingInfos`, grant + revoke of unjail authorization, and the unjail guards | | upgrade (0x…1015) | `upgrade.spec.ts` | `currentPlan` / `appliedPlan` / `upgradedConsensusState` / `moduleVersions` | ### Existing specs extended - **bank** — `spendableBalances`, `totalSupply`, `params`, `denomMetadata` (via a tokenfactory denom), `denomsMetadata` (pages until it reaches that denom, so `nextKey` round-trips). - **staking** — `grantStakingAuthorization` → `delegateWithAuthorization` → Cosmos-side delegation → `revokeStakingAuthorization` → reverts; `redelegate`/`undelegateWithAuthorization`; and the remaining query surface (`validators`, `validatorDelegations`, `unbondingDelegation`, `delegatorDelegations`, `redelegations`, `historicalInfo`, …). - **gov** — vote and proposal authorizations (`grant`/`voteWithAuthorization`/`submitProposalWithAuthorization`/`revoke`), plus `proposal`, `proposals`, `getVote`, `votes`, `params`, `getDeposit`, `deposits`, `tallyResult`. - **distribution** — `withdrawValidatorCommission`, the withdraw authorizations, and `params`, `validatorOutstandingRewards`, `validatorCommission`, `validatorSlashes`, `delegationRewards`, `delegatorValidators`, `delegatorWithdrawAddress`, `communityPool`. ### Framework - New addresses on `PRECOMPILE_ADDRESSES`. - `cosmosUtils.cosmosRest` — an LCD reader for the modules cosmjs does not wrap (mint, params, upgrade, evidence, slashing, authz, auth). Every path was taken from the module's decoded `pb.gw.go` gateway pattern rather than guessed, and every response field from its proto tag; the API server marshals with `OrigName` + `EmitDefaults`, so the reads are snake_case. - Bootstrap pool 48 → 80, with the `claimPool` budget (29) recorded next to it — a non-blocking note from the phase 2 review. Out of scope, unchanged: wasm-gated flows (wasmd, pointer `addCW*`, solo), the ibc precompile, and feegrant (0x…1010), which is not registered and whose module was removed in sei-protocol#3958. oracle stays the phase 2 retirement assertion. ## Testing performed to validate your change - `npx tsc --noEmit` clean; no lint errors. - Every assertion was reviewed against the Go executor and the sei-cosmos keeper behind it rather than against assumption. That pass corrected, among others: `historicalInfo` pinning an unreachable executor fallback instead of the querier's `historical info for height %d not found`; `nextAccountNumber` reading `next_account_number` where the response field is `count`; and mint's LCD path, which was three guesses deep with the real route last. - It also removed tests that could not fail — a `historicalInfo` try/catch asserting success in both branches, `evidence` hardcoding an empty chain in four places, `authz` index-matching expirations across two independently ordered lists, `bank.denomsMetadata` asserting only "is an array" — and replaced receipt-only verification of the authorized reward withdrawal with the `DelegationRewardsWithdrawn` credit its non-authz sibling already pins. **Not yet run against a live cluster.** The remaining risk is concentrated in real chain responses, so this wants a `make docker-cluster-start` + `npm run precompile:ci` run before merge; I will post the result on this PR. 🤖 Generated with [Cursor](https://cursor.com) Made with [Cursor](https://cursor.com) --------- Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
revofusion
pushed a commit
to revofusion/sei-chain
that referenced
this pull request
Oct 20, 2026
The feegrant module was removed in v6.7 (sei-protocol#3958), but its store stayed mounted for historical state access, and the v6.8 handler only drops its module-version entry. v6.8 already deletes the other stores v6.7 kept for the same reason (`capability`, `ibc` and `transfer`, sei-protocol#4337), which leaves `feegrant` as the last retired store still mounted, holding allowances nothing in the binary uses. `feegrantModuleName` joins `v68DeletedStores`, so the v6.8 store loader deletes the `feegrant` tree at the upgrade height and the handler's existing loop drops its version-map entry in place of the separate `DeleteModuleVersion` call. The store is unmounted everywhere sei-protocol#4337 unmounted the IBC stores, including `keys.MemIAVLStoreKeys`, whose `FeegrantStoreKey` constant goes, and the v6.8 in-process, cross-version and offline tests now treat it as deleted. Because this binary no longer mounts any store v6.7 retained, the v6.7 suite's in-process store-retention checks are removed: `TestV67RetainsRetiredModuleStateWrittenBeforeUpgrade` keeps its version-map assertions as `TestV67RemovesCommittedRetiredModuleVersions`, and v6.7's retention stays covered by its offline and cross-version suites, which build from the release branches. This is app-hash breaking at the v6.8 height. From then on v6.8 nodes answer `no such store: feegrant` at every height, so feegrant history needs a v6.7 or older node, the trade-off sei-protocol#4337 accepted for IBC. memiavl refuses to delete a tree it does not have, so the upgrade relies on every network carrying a `feegrant` tree, which holds because v6.7 mounts it and all three networks' genesis files include it. Validated with the v6.8-tagged, v6.7-tagged and untagged `app` tests, the `sei-db` keys, composite and migration packages, golangci-lint, `make fmtcheck`, and the three `upgrade-test-offline` phases from `release/v6.7` against this branch, including crash replay and the v6.7 reopen refusal; the cross-version and docker-cluster suites have not run yet. --------- Co-authored-by: Cursor <cursoragent@cursor.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
7 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Remove the feegrant module and its keeper, store, CLI, APIs, protobuf definitions, simulation support, and application wiring.